refactor!: move the cloud specification to Model

README.md

@@ -948,30 +948,29 @@ assert out.model.name == "my-model"
 assert out.model.uuid == state_in.model.uuid
 ```
 
-## CloudSpec
+### CloudSpec
 
-You can set CloudSpec information in the state (only `type` and `name` are required).
+You can set CloudSpec information in the model (only `type` and `name` are required).
 
 Example:
 
 ```python
 import scenario
 
-state = scenario.State(
-    cloud_spec=scenario.CloudSpec(
-        type="lxd",
-        name="localhost",
-        endpoint="https://127.0.0.1:8443",
-        credential=scenario.CloudCredential(
-            auth_type="clientcertificate",
-            attributes={
-                "client-cert": "foo",
-                "client-key": "bar",
-                "server-cert": "baz",
-            },
-        ),
+cloud_spec=scenario.CloudSpec(
+    type="lxd",
+    endpoint="https://127.0.0.1:8443",
+    credential=scenario.CloudCredential(
+        auth_type="clientcertificate",
+        attributes={
+            "client-cert": "foo",
+            "client-key": "bar",
+            "server-cert": "baz",
+        },
     ),
-    model=scenario.Model(name="my-vm-model", type="lxd"),
+)
+state = scenario.State(
+    model=scenario.Model(name="my-vm-model", type="lxd", cloud_spec=cloud_spec),
 )
 ```
 

scenario/consistency_checker.py

@@ -580,9 +580,11 @@ def check_cloudspec_consistency(
     errors = []
     warnings = []
 
-    if state.model.type == "kubernetes" and state.cloud_spec:
+    if state.model.type == "kubernetes" and state.model.cloud_spec:
         errors.append(
-            "CloudSpec is only available for machine charms, not Kubernetes charms. Tell Scenario to simulate a machine substrate with: `scenario.State(..., model=scenario.Model(type='lxd'))`.",
+            "CloudSpec is only available for machine charms, not Kubernetes charms. "
+            "Tell Scenario to simulate a machine substrate with: "
+            "`scenario.State(..., model=scenario.Model(type='lxd'))`.",
         )
 
     return Results(errors, warnings)

scenario/mocking.py

@@ -632,11 +632,16 @@ def resource_get(self, resource_name: str) -> str:
             )
 
     def credential_get(self) -> CloudSpec:
-        if not self._state.cloud_spec:
+        if not self._state.trusted:
             raise ModelError(
-                "ERROR cloud spec is empty, initialise it with `scenario.State(cloud_spec=scenario.CloudSpec(...))`",
+                "ERROR charm is not trusted, initialise State with trusted=True",
             )
-        return self._state.cloud_spec._to_ops()
+        if not self._state.model.cloud_spec:
+            raise ModelError(
+                "ERROR cloud spec is empty, initialise it with "
+                "`State(model=Model(..., cloud_spec=ops.CloudSpec(...)))`",
+            )
+        return self._state.model.cloud_spec._to_ops()
 
 
 class _MockPebbleClient(_TestingPebbleClient):

scenario/state.py

@@ -148,7 +148,6 @@ class CloudCredential:
 
     attributes: Dict[str, str] = dataclasses.field(default_factory=dict)
     """A dictionary containing cloud credentials.
-
     For example, for AWS, it contains `access-key` and `secret-key`;
     for Azure, `application-id`, `application-password` and `subscription-id`
     can be found here.
@@ -641,6 +640,9 @@ class Model(_DCBase):
     # TODO: make this exhaustive.
     type: Literal["kubernetes", "lxd"] = "kubernetes"
 
+    cloud_spec: Optional[CloudSpec] = None
+    """Cloud specification information (metadata) including credentials."""
+
 
 # for now, proc mock allows you to map one command to one mocked output.
 # todo extend: one input -> multiple outputs, at different times
@@ -965,6 +967,8 @@ class State(_DCBase):
     """Whether this charm has leadership."""
     model: Model = Model()
     """The model this charm lives in."""
+    trusted: bool = False
+    """Whether ``juju-trust`` has been run for this charm."""
     secrets: List[Secret] = dataclasses.field(default_factory=list)
     """The secrets this charm has access to (as an owner, or as a grantee).
     The presence of a secret in this list entails that the charm can read it.
@@ -991,8 +995,6 @@ class State(_DCBase):
     """Status of the unit."""
     workload_version: str = ""
     """Workload version."""
-    cloud_spec: Optional[CloudSpec] = None
-    """Cloud specification information (metadata) including credentials."""
 
     def __post_init__(self):
         for name in ["app_status", "unit_status"]:

tests/test_consistency_checker.py

@@ -575,6 +575,7 @@ def test_networks_consistency():
 
 def test_cloudspec_consistency():
     cloud_spec = CloudSpec(
+        name="localhost",
         type="lxd",
         endpoint="https://127.0.0.1:8443",
         credential=CloudCredential(
@@ -588,7 +589,7 @@ def test_cloudspec_consistency():
     )
 
     assert_consistent(
-        State(cloud_spec=cloud_spec, model=Model(name="lxd-model", type="lxd")),
+        State(model=Model(name="lxd-model", type="lxd", cloud_spec=cloud_spec)),
         Event("start"),
         _CharmSpec(
             MyCharm,
@@ -597,7 +598,7 @@ def test_cloudspec_consistency():
     )
 
     assert_inconsistent(
-        State(cloud_spec=cloud_spec, model=Model(name="k8s-model", type="kubernetes")),
+        State(model=Model(name="k8s-model", type="kubernetes", cloud_spec=cloud_spec)),
         Event("start"),
         _CharmSpec(
             MyCharm,

tests/test_e2e/test_cloud_spec.py

@@ -43,8 +43,10 @@ def test_get_cloud_spec():
     )
     ctx = scenario.Context(MyCharm, meta={"name": "foo"})
     state = scenario.State(
-        cloud_spec=scenario_cloud_spec,
-        model=scenario.Model(name="lxd-model", type="lxd"),
+        model=scenario.Model(
+            name="lxd-model", type="lxd", cloud_spec=scenario_cloud_spec
+        ),
+        trusted=True,
     )
     with ctx.manager("start", state=state) as mgr:
         assert mgr.charm.model.get_cloud_spec() == expected_cloud_spec
@@ -56,3 +58,14 @@ def test_get_cloud_spec_error():
     with ctx.manager("start", state) as mgr:
         with pytest.raises(ops.ModelError):
             mgr.charm.model.get_cloud_spec()
+
+
+def test_get_cloud_spec_untrusted():
+    cloud_spec = ops.CloudSpec(type="lxd", name="localhost")
+    ctx = scenario.Context(MyCharm, meta={"name": "foo"})
+    state = scenario.State(
+        model=scenario.Model(name="lxd-model", type="lxd", cloud_spec=cloud_spec),
+    )
+    with ctx.manager("start", state) as mgr:
+        with pytest.raises(ops.ModelError):
+            mgr.charm.model.get_cloud_spec()